Reconstructing trojans:
We tested feature visualization with a Fourier parameterization [1]}, [2]}, feature visualization with a pattern-producing network parameterization [3]}, [2]}, adversarial patches [5]}, robust feature-level adversarial patches [6]}, and our copy/paste attacks.
We do not include any experiments here involving applicable methods from the Trojan literature that operate by constructing adversarial features [7]}, [8]} because (1) the original papers on these methods found that while effective at reconstructing simple trojans such as single- or few-pixel ones, they failed to identifiably reproduce feature-level trojans and (2) we have also found this to be the case as well in our own experiments.
